Just designing the forgotten password form for a retailer.
When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is this reason for this?
I'm wondering whether we need to do this or not?
The temporary "password" should take the user to a page to allow the user to change their password, but not actually change the password to the temporary one in case someone other than the user requests the password change, it doesn't lock an unsuspecting user out.
The temporary one should expire, even if the site doesn't have "secure" data about the user. It is often possible to get a little information about a user and move on to another site the user uses, getting a little more information, etc. until the hacker has "elevated" enough to get through.
This is a security issue, but it is also a UX issue. When the user's personal life is negatively effected because of poor design from a single web site - this absolutely effect the user's experience in a drastic way.
The main reason is that this temporary password travelled through an unencrypted channel (email) and will possibly remain in a relatively insecure location (the mailbox). Making it expire limits the risk associated with this but also impacts the interaction with the system as it provides an incentive to actually heed the advice to supply a new password instead of relying on finding back the email and the automatically generated password later on.
Another solution to the same problem is to invalidate the previous password and make the temporary password a one-time identification token/link leading to a “change password” page but that's obviously more intrusive and could occasionally backfire.
Yet another approach on the other end of the security-convenience trade-off is to send back the original password but that means storing and transmitting it in unencrypted form. You still occasionnally come across this but security experts strongly warn against storing unencrypted passwords anywhere. Note that people often reuse their passwords so that unsafe practices entail a small risk of exposing your users to serious problems even if your application does not seem particularly critical.
Of course, the ability to request a temporary password by email or through a simple personal question also introduces new risks in itself. That's why financial transactions are usually protected through other measures like a two-factor identification or check-out process that forbid delivery to an unknown address without verifying the credit card again. This is arguably more important than making the password expire.
Finally, one last thing to consider is trust. If people are used to temporary passwords and other security measures, they might expect the same from you lest they consider your company less trustworthy that its competitors. You certainly want your design to give the impression that it's safe doing business with you.
The reason is following. When you set your password, nobody has access to it, and this is secure. But when you get a link to reset the password or even you get a temporary password, there is a risk, that somebody gets access to this email with link or with temporary password: Because it may be easier to break user's account, you have no control of passwords of your user for their emails, you have no control email servers of your users, you cannot be sure if your users share their computers with somebody else and somebody else gets access to the user's emails; also the most emails are being sent over unencrypted connections; etc. That's why the sooner the link for password reset expires, the lower is the risk that is will be used by attackers.
The temporary password should absolutely expire. Having two passwords for one account is an inherent risk. Instead, you should have the temporary password take the user to a page where they can change their password. Also, the temp should expire after a short period of time.
I think that the main reason behind it is security. The user should use temporary password to change the password/reset the forgotten password.
If in case the mail is not accessible then at that time the user may have to generate another request for temporary password.
You should do this if your account contains important data which can be misused. Financial and Banking websites usually require high security.
Generally any Forgot Password functionality should have 2 factor authentication. You could ask a security question and then send an email to the registered email address.This password should also be a temporary one and make the user change his password as soon as he has logged in with it.
A temporary password which expires only assumes that the email address has not been compromised yet but could be after the expiry period.
As someone who has done a fair bit of security compliance, I can say the answer is: ask your company's compliance officer.
Probably more important than setting the reset-window time, is ensuring your ping their SMS or other '2nd factor' when resetting. This is important in case someone else is trying to reset to break in. Consider that you can ping their 2nd factor (e.g. SMS) interactively, so that if they respond with 'freeze', or similar, then then you can immediately disable the password reset code.
20-minute resets are generally safe, though be mindful of whether your email deliverablity is good enough for them to get it in that window of time.
presume shorter time windows for financial logins, business SaaS, and similar critical systems. The same goes for social accounts if the account is 'high status' or the request comes from outside the normal activity profile.
